Re: [PHP] Register Globals workarounds

2002-05-05 Thread Philip Olson

> 2. use a .htaccess file to change register_globals for your 
> domain / dir, as long as your Apache config file allows it.
> http://www.php.net/manual/en/configuration.php

As Justin stated, doing this (use of .htaccess) is possible 
if your host allows it.  The following will work in 
.htaccess:

  php_flag register_globals on

> 3. (untested) use ini_set() to turn them back on at a 
> per-script or per-config file level.
> http://www.php.net/manual/en/function.ini-set.php

This will not work as expected, $_GET['foo'] will not 
be $foo with register_globals set via ini_set().

> 4. add this code to the top of your pages, or in a common 
> library of code / config file:
> 
>  foreach($GLOBALS as $key => $value)
> { $$key=$value; }
> ?>

This will not work, the whole point of register_globals is 
to register variables into the global scope, which is what 
$GLOBALS is.  You're also trying to rewrite a ton of variables, 
such as $_GET.  Not a good idea.  To see what I mean, try:

  print_r($GLOBALS);

Also note that $GLOBALS lives within $GLOBALS.  As do all 
the PHP variables.

> If you have this url: page.php?foo=bah, with register_globals off, 
> $foo will not be available in your script automatically, as it 
> was in older PHP versions.

Just to be clear to everyone, register_globals is a directive that 
can be set in php.ini any time, in any version of PHP.  Also read 
about the mysterious variables_order directive.

> Using the above code, we scroll through the $GLOBALS array, and for 
> each key (eg foo) we assign a var of the same name (eg $foo) and 
> assign it the matching value (eg $foo = "bah").

As stated above, this will not work.  register_globals = on will 
add 'foo' to $GLOBALS.

> I think foreach() was only available in newer versions of PHP 
> though sorry.

foreach has been around since PHP 4.0.0, see php.net/foreach 
for PHP 3 alternatives.

Now, to hack them old scripts to work, consider using either 
extract() and/or import_request_variables().  These will allow 
you to easily mimik register_globals at runtime.  I believe 
the following is a pretty good hack to get the job done:

Goal:  register a lot of variables into the global scope
order: gpcss (order of $types_to_register)

  $types_to_register = array('GET','POST','COOKIE','SESSION','SERVER');
  foreach ($types_to_register as $type) {
$arr = @${'HTTP_' . $type . '_VARS'};
if (@count($arr) > 0) {
  extract($arr, EXTR_OVERWRITE);
}
  }

Granted that it may not be identical to your register_globals, 
it may or may not be what you want so adjust accordingly.

I've posted a few related replies to this topic, see:

  Re: Using the new AUTOGLOBALS
http://marc.theaimsgroup.com/?l=php-general&m=101803683730027

  Re: tutorial on global variables
http://marc.theaimsgroup.com/?l=php-general&m=102036870428992


Regards,
Philip Olson




-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Register Globals workarounds

2002-05-05 Thread Justin French

Hi all,

For those faced with the task of updating 100's or 1000's of pages that
assumed register_globals on, I've found a couple of solutions which can work
as a temporary solution whilst you re-engineer your pages (as I plan to do).

1. simple: ask your ISP to change php.ini :)

2. use a .htaccess file to change register_globals for your domain / dir, as
long as your Apache config file allows it.
http://www.php.net/manual/en/configuration.php

3. (untested) use ini_set() to turn them back on at a per-script or
per-config file level.
http://www.php.net/manual/en/function.ini-set.php

4. add this code to the top of your pages, or in a common library of code /
config file:

 $value)
{ $$key=$value; }
?>

If you have this url: page.php?foo=bah, with register_globals off, $foo will
not be available in your script automatically, as it was in older PHP
versions.

Using the above code, we scroll through the $GLOBALS array, and for each key
(eg foo) we assign a var of the same name (eg $foo) and assign it the
matching value (eg $foo = "bah").


The ultimate (secure) solution would be to get your code up to scratch with
the new set-up (and I plan to do this, ASAP), but I myself do not have time
for this, given that I have to update MANY sites within a short time frame,
and my ISP is planning a merge to the new version very soon.


I think foreach() was only available in newer versions of PHP though sorry.


Hope this helps.


Justin French

Creative Director
http://Indent.com.au





-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php